Vulnerability · Published Feb 7, 2026 · Assigned by VulDB
CVE-2026-2109jsbroks COCO Annotator Delete Category undo improper authorization
Medium 5.4
In plain English
A medium-severity security flaw in COCO Annotator from jsbroks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category Handler. Such manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jsbroks | COCO Annotator | 0.11.00.11.1 |
Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-344685 | jsbroks COCO Annotator Delete Category undo improper authorization vdb-entry, technical-description
- VDB-344685 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #745579 | coco-annotator v0.11.1 Broken Function Level Authorization third-party-advisory
- https://github.com/nmmorette/vulnerability-research/blob/main/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo%202f1ef09b8736807aa1f7ede4b64fa35d.md exploit